[PATCH 4.8 18/33] acpi, nfit: validate ars_status output buffer size

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Williams <dan.j.willi...@intel.com>

commit 82aa37cf09867c5e2c0326649d570e5b25c1189a upstream.

If an ARS Status command returns truncated output, do not process
partial records or otherwise consume non-status fields.

Fixes: 0caeef63e6d2 ("libnvdimm: Add a poison list and export badblocks")
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 drivers/acpi/nfit/core.c |   21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsign
                 * then just continue with the returned results.
                 */
                if (status == NFIT_ARS_STATUS_INTR) {
-                       if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
+                       if (ars_status->out_length >= 40 && (ars_status->flags
+                                               & NFIT_ARS_F_OVERFLOW))
                                return -ENOSPC;
                        return 0;
                }
@@ -1858,19 +1859,32 @@ static int ars_get_status(struct acpi_nf
        return cmd_rc;
 }
 
-static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
+static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
                struct nd_cmd_ars_status *ars_status)
 {
+       struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
        int rc;
        u32 i;
 
+       /*
+        * First record starts at 44 byte offset from the start of the
+        * payload.
+        */
+       if (ars_status->out_length < 44)
+               return 0;
        for (i = 0; i < ars_status->num_records; i++) {
+               /* only process full records */
+               if (ars_status->out_length
+                               < 44 + sizeof(struct nd_ars_record) * (i + 1))
+                       break;
                rc = nvdimm_bus_add_poison(nvdimm_bus,
                                ars_status->records[i].err_address,
                                ars_status->records[i].length);
                if (rc)
                        return rc;
        }
+       if (i < ars_status->num_records)
+               dev_warn(acpi_desc->dev, "detected truncated ars results\n");
 
        return 0;
 }
@@ -2123,8 +2137,7 @@ static int acpi_nfit_query_poison(struct
        if (rc < 0 && rc != -ENOSPC)
                return rc;
 
-       if (ars_status_process_records(acpi_desc->nvdimm_bus,
-                               acpi_desc->ars_status))
+       if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
                return -ENOMEM;
 
        return 0;